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We investigate a new strategy for incoherent eavesdropping in Ekert's entanglement based quan- 
tum key distribution protocol. We show that under certain assumptions of symmetry the effective- 
ness of this strategy reduces to that of the original single qubit protocol of Bennett and Brassard. 
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Quantum Key Distribution (QKD) employs quantum 
features such as the uncertainty principle and quantum 
correlations to provide for unconditionally secure com- 
munications . In classical cryptography no mechanism 
is known for unconditionally secure key distribution. The 
importance of QKD protocols within cryptography is 
paramount as they allow for the practical implementa- 
tion of unconditionally secure cryptographic algorithms 
such as the one time pad 

A quantum cryptographic system can be thought to 
be constructed of two main parts; firstly the underlying 
quantum key distribution protocol securely establishes a 
common key between Alice and Bob, and secondly the 
message is simply encrypted with the established key, 
and transmitted. Theoretical models for quantum key 
distribution protocols based on the uncertainty princi- 
le have been analysed by Bennett and Brassard (BB84) 
and models based on quantum correlations have been 
proposed by Ekert (E91) g. 

Eavesdropping can be considered as the interception 
of a transmission between Alice and Bob by an eaves- 
dropper (Eve) and then the application of an appropri- 
ate measurement to extract information. Regardless of 
the difficulty of interception of the message, in principle 
any classical channel can always be passively monitored, 
without the legitimate users being aware that any eaves- 
dropping has taken place. This is not so for quantum 
channels. Any measurement disturbs the transmitted 
state and hence can be detected by Alice and Bob. This 
leads to a trade-off between the amount of information 
that Eve can acquire about the transmission and the de- 
gree to which she disturbs it and hence can be detected 

i- . 

In this paper we present an incoherent eavesdropping 
strategy for E91. The E91 protocol can be presented in 
four main stages: 

• Entangled photons arc distributed to Alice and Bob 
who measure them randomly choosing between two 
fixed measurement basis. This state is such that 
in the absence of noise or eavesdropping Alice and 
Bob's measurement results are the same if they 
choose the same basis; 

• Alice and Bob communicate classically their choice 
of basis for all pairs and discard all measurement 
results where different basis were used; 

• A subset of the remaining measurement results is 



publicly compared and used to determine the error 
rate (i.e. where Alice's and Bob's outcomes do not 
coincide). This error rate is assumed to be due to 
Eve; 

• Finally, if the error rate is below a certain accept- 
able threshold, then the remaining undisclosed out- 
comes are employed as the key. Otherwise, the 
outcomes are discarded and the whole process is 
repeated. 

In our eavesdropping strategy we assume that Eve pre- 
pares both photons of the entangled pair before they are 
transmitted to Alice and Bob. We do not analyse the 
most general attack of this type, but instead focus on a 
simpler symmetric attack. 

We adopt a conservative view in which Eve prepares a 
pair of photons in an arbitrary state, possibly entangled 
with other quantum systems. These auxiliary quantum 
systems are known as a probe. Without loss of gener- 
ality 0, the initial joint state of the photon pair and 
the probe can be assumed to be a pure state of the 
following form: 
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where {| 0) + , 1 1) + } is a basis for the polarisation state of 
a single photon. The states | a)+ and | /?)+ refer to Alice 
and Bob's respective photon states. The kcts for Eve's 
probe I Ea,p) are not necessarily normalised or orthogo- 
nal. The only condition on these vectors is the overall 
normalisation of I^/j), leading to: 
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If we assume that Alice controls the EPR source, then 
the security of the above E91 scheme is equivalent to the 
security of BB84 protocol |^ . This is because Alice first 
generates an entangled pair locally, keeps one photon and 
sends the other to Bob. Therefore only one photon can 
be intercepted and measured by Eve which is thus anal- 
ogous to BB84. 

Notice that if Eve is limited only to eavesdropping on 
the quantum channel between the source and Bob, her 
eavesdropping can be described without loss of general- 
ity as an unitary interaction between Bob's photon and 
Eve's probe: 
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where | F) is the initial state of Eve's probe, and the 
I Fa^fj) are again not necessarily normalised or orthogo- 
nal, but obey the unitarity conditions: 



(-^00 I ^bo) + (^01 I -Pbi) — 1, 
(i^io I -Fio) + (^11 I i^ii) = 1, 
(i^oo I Fw) + (^01 I i^ii) = 0. 
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The resulting global state of the pair and the probe is: 
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However, because of the unitarity conditions 
(Eqn. the global state obtained by Eve when 

she is only accessing one of the photons is not as general 
as the state she can obtain when she can access both as 
in Eqn. (|l]). Therefore this proves that the eavesdropping 
strategy in which Eve controls the source (i.e. both pho- 
tons) is potentially stronger than the strategy in which 
she is allowed to eavesdrop on only one photon. 

We now turn our attention to a symmetric subclass 
of incoherent attacks against E91 in which Eve controls 
the source. We derive the probability that Eve guesses 
Alice's bit correctly as a function of the error probabil- 
ity that Alice and Bob can estimate from comparing a 
fraction of the key bits they obtain. 

Let {| 0) + , I 1)+} be a basis for the polarisation state 
of a single photon. We define its conjugate basis 
{|0)x,|l>x} by |0)x = (|0)+ + |l> + )/V2 and 1 1) 
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l) + )/\/2. For any h G {+, x} we use the 



shorthand notation | a/3)b for the state of a pair of 
photons in which Alice's photon is in state | a)h and 
Bob's photon in the state | /?)(,. We define the Bell 
basis {| 0), 1 1), I 2), I 3)} for the pair of photons Alice 
and Bob receive by |0) = (|00)+ + |ll) + )/V2, |1) = 
(I 00)+ - |ll) + )/V2, 1 2) = (I 01)+ + |10)+)/V2 and 
I 3) = (I 01)+ — I 10) + )/-\/2. In the most general incoher- 
ent attack. Eve prepares two single photons and a probe 
in any pure state 1-0) = X]c=o I Fc) \ c), where for simplic- 
ity we use the Bell basis. The kets for the probe, | Ec) 
as previously mentioned are not necessarily normalised 
or orthogonal, but nevertheless have to obey the overall 
normalisation relation X)c=o('^c | Ec) = 1. It is straight- 
forward to check that 
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Eve sends each of the photons to Alice and Bob. After 
public communication between Alice and Bob, Eve then 
performs any measurement on her probe. We say that an 
incoherent attack is furthermore symmetric if and only 
if for any common choice of basis, the probability distri- 
bution of Alice's bit is uniform irrespective of whether or 
not Alice and Bob share the same bit value. 

Given that Eve is restricted to performing an incoher- 
ent symmetric attack, the above condition requires that 
Pr(a = 0,/? = 0| basis b) = Pr(a = l,/3 = 1| basis h) 
and Pr(a = 0,/3 = 1| basis 6) = Pr(a = l,/3 
0| basis h) for any choice of basis h. This implies that 
^{Eo I El) = ^{E2 I E3) = ?ii{Eo I E2) = ?ii{Ei I E3) = 0. 

The probability that Alice and Bob fail to share the 
same bit value given that they have chosen the same ba- 
sis b G x} reads: 
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where the identity operator acts on the Hilbert space of 
the probe and where we have used the shorthand no- 
tation X = {Eo\Ea), y = {El \Ei), z = (E2 \ E2) and 

t = {E3\E3). 

We assume that, after public discussion between Alice 
and Bob, Eve is aware of their chosen basis, and whether 
or not their measurements yielded the same bit value. 
From this data Eve's objective is to guess Alice's bit 
value a. Assuming that Alice and Bob chose the ba- 
sis 6 = -I- and that their measurement returned the same 
bit value, we see from Eqn. (^ that Eve has to find out 
whether her probe is in the state ^ ^°/x+y^'^ ' correspond- 



ing to a = or in the state 



J_EoM_Bi). 
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corresponding to 



a — 1. Given a quantum system that is equally likely 
to be in either the state 1 77) or \x), it is known that 
the optimal probability of guessing this state correctly is 
Pc = 5 + i^l- |(r?|x)P @- In our case. Eve's proba- 
bility of guessing correctly is: 
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If Alice and Bob chose the basis b = +, but that their 
measurements returned different bit values. Eve has to 



find out whether her probe is in the state 
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Eve's probability of guessing correctly is now: 
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Similar calculations in the conjugate basis give: 
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Given that the choice of the basis b is uniformly dis- 
tributed, the marginal probability that Eve guesses Al- 
ice's bit correctly is: 
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where we have used the normalisation condition x + y + 
z + t = 1. Since y, z and t arc non negative numbers, the 
domain for a; is [1 — e+ — ex , 1 — max(e+, ex )]. 

Now given the average error probability e — ^^'-j^, 
the above probability of a correct guess is maximal when 
e+ = ex = e. In other words, given the average error 
probability, the eavesdropping strategy that maximises 
the average probability of correct guess is the one for 
which the error probability is independent of the choice 
of basis. The resulting probability of correct guess: 
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Pc = 2 + Vl-e-x (VS + V2e + x- l) (20) 
reaches its maximum for a; = 1 — 2e + e^ at which point: 
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= 2 + v/^(l-e). 



(21) 



The above formula is identical to the formula obtained 
by Cirac and Gisin |^ in their study of the security of 
BB84 against a class of incoherent attacks with similar 
conditions for symmetry (see Fig. 1). The fact that our 
incoherent symmetric eavesdropping strategy has effec- 
tively the same power as the BB84 incoherent symmetric 
eavesdropping strategy is surprising. This is particularly 
so given that the maximally entangled state |00) + -f-|ll) + 
has the following interesting property: 

A(g)/(|00>+ + |ll>+) = /® A^(|00)+ + |11) + ), (22) 

where A is any operator. This implies that any operation 
on one qubit can be executed remotely by performing the 
transpose of that operation on the other qubit, providing 
that the state of the two qubits is maximally entangled. 
In spite of this, there is no operator C such that 

A ® B{\00)+ + |11) + ) = / ® C(|00)+ + |11) + ), (23) 



which is why the two qubit attack is strictly more general 
than the single qubit attack. This is of course because 
the operation represented by B will in general result in a 
non-maximally entangled state which no longer has the 
property of remote execution of operations. 

Note that the above result can also be expressed as 
a trade-off between the error rate and the mutual infor- 
mation obtained by Eve about the nature of the state 
communicated by Alice to Bob. In this case we have 
a situation equivalent to a binary symmetric channel so 
that the mutual information is the capacity of that chan- 
nel and is given by 



/ = 1 + logP, + (1 - P,) log(l - P,). 



(24) 



As before, the greater the mutual information gained by 
Eve the greater the (detectable) error rate induced in the 
communication . 

In this paper we have analysed a symmetric incoherent 
eavesdropping strategy in E91 quantum key distribution 
protocol. We have assumed that Eve controls preparation 
of the entangled photons. In spite of this, we have found 
that there is no benefit for the purpose of eavesdropping 
when compared to symmetric incoherent eavesdropping 
in BB84. We hope that this stimulates further investiga- 
tion into entanglement based quantum cryptography. 
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FIG. 1. The figure shows the efficiency of the symmetric 
two qubit attack. The probability of correct guess is plotted 
against the error rate induced by eavesdropping. 
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